I'm in the process of implementing wired 802.1x. I've been testing with HP 2530 switches and everything seems to work okay enough. On a different site I use Brocade (now Ruckus) 6450 switches. I can enable 802.1x and devices can authenticate.
The HP switches appeared to authenticate for the port on the switch, but the brocade switches seem to authenticate the mac address. The difference being that if I attach another switch to the HP switch then multiple devices or mac addresses can have their traffic pass on the single port. On the brocade device any new mac addresses are expected to authenticate. But because the second switch I have added is doing the authentication the clients connected to this switch end up being blocked.
I can't test it right at this minute with a wireless access point but my testing suggests that whilst my access point can authenticate, the clients connected to the access point cannot. I also have a number of Axis network video encoders (P7216 https://www.axis.com/en-gb/products/axis-p7216) which while only having a single network port utilise four MAC and IP Addresses. Again I imagine only one of the MAC addresses would authenticate.
Does anyone have any experience of this? I think it should be a feature I can disable (or have only enabled inadvertently.) But I'm not sure what it might be called. I can see how authenticating multiple devices on a single port could be useful but in the cases I have given this isn't so.
Currently for testing purposes I am using a HP/Aruba 2530-8 switch as my supplicant. I will actually be using Arbuba AP-315 wireless access points and the axis device I mentioned. This is because the Authenticator switch I have on site doesn't support POE and the Axis encoders are in production.
On the site that I work we use HP/Aruba 2530-48g-poe+ switchs as access switches. When I connect the 2530-8 to the 2530-48-poe+ switch the radius server returns the vlan configuration in the usual manner and the port on the authenticator is configured as specified. Clients that plug into the 2530-8 switch don't need to authenticate against the 2530-8 switch and they can access the network through the port that has been enabled on the 2530-48-poe+ switch. This is what I want to happen.
On another site we use Brocade 6450 switches. When the same 2530-8 switch plugs in to the brocade switch the 2530-8 switch is enable and I can ping the management interface of the supplicant switch. However clients that are connected to the 2530-8 are blocked by the brocade switch that acts as the authenticator because it sees the mac addresses of the clients and deems them to not have authenticated. I do not want this.
I believe in Aruba/HP these two scenarios are port mode 802.1x and user mode 802.1x. But I'm not sure this translates to other manufacturers. Brocade has documentation on using multiple users that are authenticated on a single port but the implementation doesn't work how I want. Effectively the client is still required to authenticate against the brocade switch but this is in turn blocked by the 2530-8 switch as it is handling the authentication.